Investigating Claude Misuse: Evidence Sources & Retention

Could you work out what Claude did in your organisation last month? Who asked it for what, which files it read, which tools it ran and whether anything left the building? The honest answer for most teams is "partly". It depends on your Claude plan, how Claude is deployed, and whether you switched evidence collection on before the incident. That is the central finding of Frontier Forensics: Anthropic, a guide published by Invictus Incident Response in October 2026.

Who this is for: CISOs, incident responders and platform owners running Claude Enterprise or Team, the Claude Platform (API and Console), Claude Code or Claude Cowork.

Independent summary of the Invictus report, which synthesises Anthropic's documentation as reviewed in October 2026. Each product fact links to the Anthropic page the report cites. PlayCISO is not affiliated with Anthropic or Invictus. Settings and retention can change: check the linked documentation before you rely on a number.

Why this matters: three incidents found months later

In July 2026 Anthropic disclosed three incidents found by a retrospective review of its cybersecurity evaluation runs (Anthropic: Investigating three real-world incidents in our cybersecurity evaluations). As the Invictus report summarises it, evaluation environments believed to be isolated had unintended internet access. In one incident, Claude published a malicious Python package to PyPI while pursuing a capture-the-flag objective. The package was public for roughly one hour and was downloaded and run on 15 real systems. One was a security company's scanner, which installed the package and exposed that company's credentials.

The earliest activity dated to April 2026; Anthropic began its review on 23 July 2026. Anthropic said it generally stores traces for benchmark evaluations, which is what made a review months later possible. The two affected organisations Anthropic reached had not detected the activity themselves, and Anthropic noted that a review of network logs would have surfaced it. We covered the incident itself in AI agent published real malware to PyPI.

The report's lesson in one line: evidence that was retained can be reviewed later; evidence that was never retained cannot be recovered.

The three rings of Claude evidence

Invictus groups Claude evidence into three locations around an incident. You usually need all three.

The Activity Feed records authentication, credential creation, role changes, object access and changes to organisational controls, covering identities, workspaces, connectors, settings and content access. It is collected with GET /v1/compliance/activities (API reference). Customer telemetry adds the detail Anthropic's records lack: host, repository, tool, approval and content. Correlate Cowork OTel with prompt.id, and Claude Code OTel with tool_use_id and request_id, which also lead into session transcripts.

Retention at a glance

Four windows are fixed. Most of the rest is yours to set, which means it is also yours to get wrong.

Want to feel how fast these close? Evidence Expiry Race puts the windows on a clock.

The Team-plan gap

Per the report, Claude Team lacks the Compliance API and the CSV audit export. A Team investigation has no Anthropic-held Activity Feed to lean on, so it depends on Claude Code and Cowork OpenTelemetry (available on Team, if you configured it), endpoint artefacts, and records from your identity provider and connected systems. If you are on Team and handle sensitive work, set up telemetry and endpoint collection now, or weigh that gap in your plan choice.

Collect with a read-only key

Anthropic-held content is retrieved with a Compliance Access Key, and its scopes are set at creation. The report's advice: collect with read:compliance_user_data only. The separate delete:compliance_user_data scope permits permanent deletion of supported Anthropic-held content, and "a compromised key with deletion rights could be used to destroy content relevant to an investigation." Deletion does not necessarily erase Activity Feed records or independently retained copies, so do not treat it as removal of all evidence either way.

API prompts need your own logs

If you build on the Claude API, the prompts and responses your application exchanges are not available as conversation history through the Compliance API. Your application's logs may be the only record of what an internal assistant sent to Claude and what came back. Capture the identifiers that link each request to its response and to the user, session or job that triggered it, and confirm early what is logged and how long it is kept.

Five places to start an investigation

The report scopes Claude investigations from five starting points. Start from the environment under investigation (claude.ai, Claude Platform, Claude Code or Cowork), then corroborate with identity provider, repository, cloud, SaaS and MCP server logs. Practise choosing in the AI Investigation Scoping Lab.

Two of these are hands-on in our labs: hunt starting point 3 in the Agent Defence-Evasion Hunt, and for starting point 2 on the endpoint, the report warns that configuration and memory files can contain instructions injected to influence an agent. Practise spotting them in the Poisoned Instruction File Lab.

What to set up this quarter

• Enable the Compliance API and Activity Feed if you are on Enterprise. The six-year clock starts at enablement and there is no backfill (set up the Compliance API).
• Create a read-only collection key (read:compliance_user_data) and keep delete:compliance_user_data off any key used for collection.
• Pull the Activity Feed into your SIEM on a schedule, and alert on the defence-evasion events listed above.
• If you depend on the CSV export, know its limits: 180 days, no chat or project content, no CMEK, and a link that dies in 24 hours.
• Configure Claude Code and Cowork OpenTelemetry to a collector you control (Cowork monitoring reference), retain it, and keep prompt.id, tool_use_id and request_id.
• Write the endpoint acquisition step into your playbook: the user's ~/.claude directory, ~/.claude.json and project configuration and instruction files, collected before the 30-day default cleanup.
• Log API traffic in your own applications, with identifiers linking request, response and the user, session or job.
• Retain inference hook security-server records if you use inference hooks.
• Keep network and egress logs. In Anthropic's evaluation incidents, network logs would have surfaced the problem.
• On Team, compensate for the missing Compliance API with telemetry, identity provider and endpoint collection.
• Test it. Run the AI Evidence Readiness check and confirm you can actually retrieve each source.

FAQ

Can you investigate misuse of Claude in your organisation?

Only partly, unless you prepared. Invictus Incident Response's Frontier Forensics report says the answer depends on the Claude plan, how Claude is deployed, and whether evidence collection was configured before the incident. Evidence comes from three places: records Anthropic retains, telemetry you export to your own systems, and files on your endpoints and in your applications. You need all three to reconstruct what happened.

How long does Anthropic keep Claude Enterprise audit logs?

Per the report, Anthropic retains Activity Feed records for six years from when the feed is first enabled, and nothing before enablement can be backfilled. The Enterprise CSV audit export, the fallback when the Compliance API was not enabled, has a lookback of up to 180 days, and its download link expires after 24 hours.

Does the Claude Team plan have audit logs or a Compliance API?

According to the report, Claude Team has neither the Compliance API nor the CSV audit export. Team investigations therefore lean on OpenTelemetry from Claude Code and Cowork (available on Team and Enterprise, if configured in advance), endpoint artefacts, and records from the identity provider and connected systems.

Where does Claude Code store logs on a laptop, and for how long?

The report says Claude Code keeps session transcripts, tool results, prompt history and file snapshots locally, with configuration in the user's ~/.claude directory, ~/.claude.json, .mcp.json, hooks, plugins and instruction files such as CLAUDE.md. The cleanupPeriodDays setting defaults to 30 days and applies to transcripts and several other paths; history.jsonl, auto memory and Desktop or Cowork transcripts follow different rules. Acquire these early.

Are Claude API prompts and responses available through the Compliance API?

No. The report's seventh finding is that ordinary API prompts and responses need application-side logging and are not available as conversation history through the Compliance API. If your app does not log the request, the response and which user, session or job triggered it, that record may not exist anywhere you can reach.

What scope should a Compliance API collection key have?

Read only: read:compliance_user_data. The report warns that the separate delete:compliance_user_data scope permits permanent deletion of supported Anthropic-held content, so a compromised key with deletion rights could be used to destroy content relevant to an investigation. Deletion does not necessarily erase Activity Feed records or independently retained copies.

Sources

• Invictus Incident Response: Frontier Forensics: Anthropic, v1.0, October 2026 (TLP:CLEAR): evidence sources, retention, scoping starting points and cheat sheet.
• Anthropic: Investigating three real-world incidents in our cybersecurity evaluations
• Anthropic: Compliance API overview · Set up the Compliance API · Query the Activity Feed · Compliance activities API reference
• Anthropic: Retrieve session transcripts · Retrieve and delete chats, files, and projects · Compliance API FAQ
• Anthropic: Access audit logs · Configure custom data retention controls for Enterprise plans · API and data retention
• Anthropic: Claude Code monitoring · Explore the .claude directory
• Anthropic: Monitor Claude Cowork activity with OpenTelemetry · Cowork monitoring reference
• Anthropic: Inference hooks

This article is educational guidance for security leaders, not legal advice or a forensic procedure. Retention and plan features are as the Invictus report describes Anthropic's documentation in October 2026.